Vulnerability · Published Jul 14, 2026 · Assigned by eclipse
CVE-2026-8384
Medium 5.3
In plain English
A medium-severity security flaw in Eclipse Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | jetty12 | no fix listed | DEBIAN-CVE-2026-8384 |
| Debian:14 | jetty12 | 12.0.39-1 | DEBIAN-CVE-2026-8384 |
| Debian:12 | jetty9 | no fix listed | DEBIAN-CVE-2026-8384 |
| Debian:13 | jetty9 | no fix listed | DEBIAN-CVE-2026-8384 |
| Debian:14 | jetty9 | no fix listed | DEBIAN-CVE-2026-8384 |
| Maven | org.eclipse.jetty:jetty-util | 12.0.35 | GHSA-w7x5-g22v-xqhr |
| Maven | org.eclipse.jetty:jetty-util | 12.1.9 | GHSA-w7x5-g22v-xqhr |
| Ubuntu:26.04:LTS | jetty12 | no fix listed | UBUNTU-CVE-2026-8384 |
| Ubuntu:26.10 | jetty12 | no fix listed | UBUNTU-CVE-2026-8384 |
| Ubuntu:22.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2026-8384 |
| Ubuntu:24.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2026-8384 |
| Ubuntu:26.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2026-8384 |
| Ubuntu:26.10 | jetty9 | no fix listed | UBUNTU-CVE-2026-8384 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 12.0.0 – through 12.0.3412.1.0 – through 12.1.8 |
Weakness: CWE-647 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N